Brevo Breach Exposes Crypto Users to Phishing Risks

A security breach at Brevo, an email marketing platform used by several crypto companies, exposed a vulnerability that allowed attackers to gain unauthorized access to 138 customer accounts. On September 9-10, 2026, an attacker exploited a flaw in Brevo's SAML SSO handling, which is a single-sign-on authentication mechanism.

The breach sent ripples across the crypto industry, prompting Solana Mobile to warn its users about elevated phishing risks. The attacker gained unauthorized access to six accounts, which were then used to send phishing emails directly to subscribers. Another 43 accounts had their contact lists exported, meaning email addresses quietly left the building.

The crypto sector bore the brunt of the targeting, with Trezor, BitBox, and CoinTracking confirming their Brevo accounts were among those exploited. The phishing campaigns leaned on a familiar playbook: impersonate a trusted brand, manufacture urgency around a fabricated security issue, and push the recipient toward a malicious link or credential-harvesting page.